Goal88 Privacy Policy — Malaysia Player Data Protection

1 Introduction

This Privacy Policy ("Policy") is published by goal88 ("we", "Platform", or "Company") and applies to all users who access or use the goal88 platform via our website, mobile app, or any digital channel we operate.

This Policy describes the types of personal data we collect, why we need it, how it is used and protected, and your rights as a data subject. This document has been prepared in accordance with the requirements of Malaysia's Personal Data Protection Act 2010 (PDPA) and international best practices in data privacy management.

By using the goal88 platform, you consent to the collection and processing of your personal data as described in this Policy. If you do not agree, please stop using the platform and contact us to request account deletion.

2 Personal Data We Collect

Goal88 collects personal data through several methods — directly from you during registration, automatically during platform use, and in certain cases, through authorised third parties. Below is a detailed table of the types of data we collect:

We do not collect sensitive data such as medical information, religious beliefs, or political views. Should we require additional data for a specific purpose, you will be informed in advance and your consent will be sought explicitly.

3 Purpose of Personal Data Use

Every piece of data collected by goal88 has a specific and lawful purpose. We process your personal data for the following purposes:

• Account management: Creating, verifying, and maintaining your player account, including mandatory KYC processes.
• Financial transaction processing: Processing deposits, withdrawals, and all financial transactions securely and accurately.
• Platform security: Detecting and preventing fraud, money laundering, unauthorised access, and other suspicious activities.
• Legal compliance: Meeting obligations under the PDPA 2010, Anti-Money Laundering Act (AMLA), and other applicable regulatory requirements.
• Service improvement: Analysing usage patterns to improve the platform, diversify games, and enhance the player experience.
• Support communications: Responding to inquiries, resolving complaints, and providing technical assistance to players.
• Responsible gaming: Monitoring gameplay patterns to identify players who may need responsible gaming support.
• Relevant marketing: Sending promotions and offers tailored to your interests — only if you have given consent to receive marketing communications.

4 Data Sharing with Third Parties

Goal88 does not sell, rent, or transfer your personal data to third parties for their own commercial purposes. However, in certain limited contexts, we may need to share your data with the following parties:

• Payment providers: Financial institutions, payment processors, and e-wallet providers used to process your transactions. They are bound by strict confidentiality agreements.
• KYC providers: Registered and approved third-party identity verification companies that assist us in carrying out the required identity verification process.
• Gaming technology providers: Game developers and platform providers supporting the technical operations of goal88, with access strictly limited to the data required.
• Legal authority: Law enforcement agencies, regulatory bodies, or courts where we are legally required to disclose such information.
• Auditors and professional advisors: Audit firms, legal firms, or financial advisors involved in company operational reviews, subject to professional confidentiality obligations.

All third parties receiving goal88 player data are required to comply with security and privacy standards no less stringent than our own. We conduct periodic risk assessments of all third-party partners to ensure ongoing compliance.

5 Data Security

Goal88 continuously invests in cybersecurity infrastructure to ensure player personal data remains protected at all times. The security measures we implement include:

• Encryption of data in transit: All communications between your device and goal88 servers use TLS 1.3 protocol with 256-bit encryption.
• Encryption of data at rest: Sensitive data such as financial information and KYC documents are encrypted at rest using AES-256 algorithms.
• Layered access control: Only staff with specific job-related needs are granted access to player data, with every access logged and monitored.
• Two-factor authentication: goal88's internal systems use multi-factor authentication to prevent unauthorised access by staff or external parties.
• Periodic penetration testing: We conduct regular security testing through independent cybersecurity firms to identify and address vulnerabilities.
• 24/7 threat monitoring: Automated monitoring systems operate around the clock to detect and respond to any suspicious activity immediately.

While we take all reasonable steps to protect your data, no digital system can be guaranteed 100% secure. You also play an important role in account security by using a strong password, not sharing your login credentials, and keeping your device protected with up-to-date security software.

6 Your Rights as a Data Subject

Under Malaysia's Personal Data Protection Act 2010 and the privacy principles we uphold, you have the following rights regarding your personal data on the goal88 platform:

To submit any data rights request, please contact the goal88 support team via live chat or our official email. We will process your request within 30 calendar days from the date of receipt.

7 Cookies & Tracking Technologies

Goal88 uses cookies and similar tracking technologies to enhance the user experience and understand platform usage patterns. The types of cookies we use are:

• Essential Cookies: Required for core platform functions such as login authentication, session security, and language preferences. These cookies cannot be disabled without affecting platform functionality.
• Performance Cookies: Collecting information on how players use the platform — which pages are visited most, response times, and error messages. This data is used to improve platform performance.
• Functional Cookies: Storing user preferences such as language, display theme, and account settings to deliver a more personalised experience.
• Analytics Cookies: Helping us understand how players interact with the platform as a whole, using internal analytics tools that do not share data with third parties.

8 Data Retention Period

Goal88 retains your personal data only for as long as necessary to fulfil the purposes stated in this Policy, or as required by applicable Malaysian law.

• Active account data: Retained for the duration your account is active and for a reasonable period after account closure for dispute or compliance purposes.
• Financial transaction records: Retained for at least 7 years in accordance with Malaysia's financial and anti-money laundering legal requirements.
• KYC documents: Retained for the duration of membership and for at least 5 years after account closure in accordance with AML compliance requirements.
• Support communication logs: Retained for 3 years for reference and dispute resolution purposes.
• Technical data and logs: Retained for 12 months for security and technical troubleshooting purposes.

Once the specified retention period has expired, your personal data will be securely deleted or anonymised in a manner that can no longer be associated with you personally.

9 Amendments to the Privacy Policy

Goal88 reserves the right to update or amend this Privacy Policy from time to time in response to changes in law, technology, or business practices. Any material amendments will be communicated to players via:

• In-platform notification of at least 14 days before the amendment takes effect.
• Email to your registered email address for significant amendments.
• Update the "Last Updated Date" at the top of this document.

It is your responsibility to review this Policy periodically. Continued use of the goal88 platform after any amendments take effect will be deemed your acceptance of the updated terms. If you do not agree with the changes, you may stop using the platform and request account closure before the amendment takes effect.

10 Contact Us About Privacy

If you have any questions, concerns, or complaints regarding this Privacy Policy or how we handle your personal data, the goal88 Data Protection Officer (DPO) team is ready to assist you.

We are committed to addressing all privacy inquiries seriously and within the stipulated timeframe. An initial response will be provided within 48 working hours, and more complex cases will be resolved within a maximum of 30 calendar days.

If you are not satisfied with how we handle your privacy complaint, you have the right to lodge a complaint with the Personal Data Protection Commissioner of Malaysia or the relevant regulatory authority in your jurisdiction.